Enterprise Identity Management (IdM) PKI Cannot Publish CRL After Upgrade to Red Hat Enterprise Linux 6.4/IdM 3.0

Issue

• The directory where IdM PKI publishes the CRL (/var/lib/ipa/pki-ca/publish/) gets incorrect ownership after the ipa-server package is updated or reinstalled, which leads to PKI not being able to update CRL in this directory:

# ls -la /var/lib/ipa/pki-ca/publish/
total 244
drwxr-xr-x. 2 root pkiuser 12288 May 17 04:49 .     <<< owned by pkiuser group
drwxr-xr-x. 3 root    root     4096 May 17 04:49 ..
...
-rw-rw-r--. 1 pkiuser pkiuser   414 May 17 01:00 MasterCRL-20130517-010000.der
lrwxrwxrwx. 1 pkiuser pkiuser    57 May 17 01:00 MasterCRL.bin ->
/var/lib/ipa/pki-ca/publish/MasterCRL-20130517-010000.der

/var/lib/ipa/pki-ca/publish/ changes when freeipa-server package gets reinstalled or updated:

# yum reinstall ipa-server

# ls -la /var/lib/ipa/pki-ca/publish/
total 244
drwxr-xr-x. 2 root    root    12288 May 17 04:49 .     <<< owned by root
drwxr-xr-x. 3 root    root     4096 May 17 04:49 ..
...
-rw-rw-r--. 1 pkiuser pkiuser   414 May 17 01:00 MasterCRL-20130517-010000.der
lrwxrwxrwx. 1 pkiuser pkiuser    57 May 17 01:00 MasterCRL.bin ->
/var/lib/ipa/pki-ca/publish/MasterCRL-20130517-010000.der